@Lisa71 

It will run in the session of that user whose credentials 3rd party is using, either Basic OR OAuth 2.0

If no credentials uses then as mentioned by @Chaitanya ILCR -> it is guest user (Not recommended practice)

Requires Authentication -> Blocks unauthenticated/anonymous access

Requires ACL Authorization -> Enforces ACL security on REST endpoint

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏